applied: [PATCH proxmox 0/3] s3-client: fix request signing and update request time on retry

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

On Wed, 07 Oct 2026 14:34:03 +0200, Christian Ebner wrote:
> This patch series fixes 2 issues with the current s3-client
> implementation.
> 
> In particular:
> - Patch 1 fixes an issue with s3-client request signing, encountered
>   during development. The canonical request headers and query
>   parameters were incorrectly sorted by key+value strings instead
>   of key only, which could lead to sorting mismatches with the API
>   server, resulting in signature mismatches and therefore rejected
>   requests. In particular, this might be encountered if one header
>   name is a prefix to another header name.
>   Fixed by sorting headers and queries via their respective key only.
> - Patches 2+3 fix a not updated request time for requests being
>   retried. This could potentially lead to `RequestTimeTooSkewed`
>   errors when the time in-between retried requests is very large and
>   might explain such errors observed as reported in the community
>   forum [0].
>   Fixed by setting the current request time and updating the request
>   signature each time before sending the request via the client.
> 
> [...]

Applied, thanks!

For the first patch I adapted the query parameter handling a bit: the
parameters are now URI-encoded first and only then sorted, with the
encoded value ordering duplicate names, as that is the order the SigV4
docs specify for the canonical request [0]. Sorting the raw pairs could
still produce a different order than the server computes, e.g., for
names where the encoded form sorts differently or for repeated
parameters.

[0]: https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html

[1/3] s3-client: fix header and query parameter sorting during aws sign v4
      commit: 91e7f7e8a135d3bc3826ab50e05d3126c039df11
[2/3] s3-client: factor out request signing and related header updates
      commit: 97960079e9c715559ac7d94421a5eb40d1052740
[3/3] s3-client: update request time and signature on retries
      commit: 07a4feb646fdeaf4651da81490bb921b646d80e4